add

deploy/config.example.yaml

@@ -198,12 +198,18 @@ api:
   trusted_proxies: []
   cors_origins: []
   auth:
-    # none | apikey | basic
+    # none | apikey | basic | oidc
     mode: apikey
     api_keys: ["CHANGE-ME-long-random-string"]
     read_only_api_keys: []
     trust_loopback: true
     session_ttl: 12h
+    # For mode: oidc, configure a registered public PKCE client and the API
+    # audience included in its access tokens. Users need the admin role to write.
+    oidc_issuer: https://users.k6n.net
+    oidc_audience: https://fancy-dns.example.net
+    oidc_client_id: fancy-dns
+    oidc_write_roles: [admin]
   rate_limit:
     per_minute: 600
     failures: 10

deploy/k8s/00-config.yaml

@@ -113,8 +113,12 @@ data:
       # is unset, so a missing secret is a crash loop rather than an
       # unauthenticated console.
       auth:
-        mode: apikey
+        mode: oidc
         api_keys: ["${FANCYDNS_API_KEY}"]
+        oidc_issuer: https://users.k6n.net
+        oidc_audience: https://dns.k6n.net
+        oidc_client_id: fancy-dns
+        oidc_write_roles: [admin]
         trust_loopback: false
 
     metrics:

deploy/k8s/08-secret-apikey.yaml

@@ -4,10 +4,9 @@
 #   kubectl -n dns create secret generic fancy-dns-apikey \
 #     --from-literal=api-key="$(openssl rand -hex 32)"
 #
-# With auth.mode: apikey and api_keys: ["${FANCYDNS_API_KEY}"] in the config,
-# a missing FANCYDNS_API_KEY is a startup error rather than an empty key, so a
-# forgotten secret shows up as a CrashLoopBackOff and not as an unauthenticated
-# console on the network.
+# With api_keys: ["${FANCYDNS_API_KEY}"] in the config, a missing
+# FANCYDNS_API_KEY is a startup error rather than an empty key. These keys
+# remain available for machine clients when the console uses OIDC.
 apiVersion: v1
 kind: Secret
 metadata: